[UNIX] Adobe Acrobat Reader Buffer Overflow (UnixAppOpenFilePerform)

From: SecuriTeam (support_at_securiteam.com)
Date: 07/06/05

  • Next message: SecuriTeam: "[EXPL] TCP Chat(TCPX) DoS (Exploit)" 
    To: list@securiteam.com
Date: 6 Jul 2005 14:20:45 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Adobe Acrobat Reader Buffer Overflow (UnixAppOpenFilePerform)
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.adobe.com/products/acrobat/readermain.html> Adobe Acrobat
    Reader is a program for viewing Portable Document Format (PDF) documents.

    Remote exploitation of a buffer overflow in Adobe Acrobat Reader for UNIX
    allows an attacker to execute arbitrary code.

    DETAILS

    Vulnerable Systems:
     * Adobe Acrobat Reader version 5.0.9 for UNIX
     * Adobe Acrobat Reader version 5.0.10 for UNIX

    Immune Systems:
     * Adobe Acrobat for Windows
     * Adobe Acrobat version 7.0 for UNIX

    The vulnerability specifically exists in the function
    UnixAppOpenFilePerform(). This routine is called by Acrobat Reader while
    opening a document containing a /Filespec tag. Within this routine,
    sprintf is used to copy user-supplied data into a fixed-sized stack
    buffer. This leads to a stack based overflow and the execution of
    arbitrary code. The following demonstrates what the overflow looks like in
    a debugger:
    ---------------------------------
    #0 0x41414141 in ?? ()
    (gdb) i r ebx
    ebx 0xbfffef54 -1073746092
    (gdb) x/x 0xbfffef54
    0xbfffef54: 0x40404040
    (gdb)
    ----------------------------------

    As shown, EIP is easily controllable; ebx also points to the 4 bytes
    before the EIP overwrite in a controlled buffer. This allows remote
    exploitation without having to know stack addresses, as an attacker can
    craft an exploit to return to a jmp ebx or call ebx instruction.

    Successful exploitation allows an attacker to execute arbitrary code under
    the privileges of the local user. Remote exploitation is possible via
    e-mail attachment or link to the maliciously crafted PDF document. The
    impact of this vulnerability is lessened by the fact that two error
    messages appear before exploitation is successful; however, closing these
    windows does not prevent exploitation from occurring.

    Workaround:
    User awareness is the best defense against this class of attack. Users
    should be aware of the existence of such attacks and proceed with caution
    when following links from suspicious or unsolicited e-mail. Users should
    consider using an unaffected version of Adobe Acrobat, such as Acrobat
    7.0.

    Vendor response:
    Adobe has addressed this issue in the following security advisory:
     <http://www.adobe.com/support/techdocs/329083.html>
    http://www.adobe.com/support/techdocs/329083.html

    Adobe is recommending the following steps for remediation:
    -- If you use Adobe Reader 5.0.9 or 5.0.10 on Linux or Solaris, download
    Adobe Reader 7.0 at
    <http://www.adobe.com/products/acrobat/readstep2.html>
    www.adobe.com/products/acrobat/readstep2.html.

    -- If you use Adobe Reader 5.0.9 or 5.0.10 on IBM-AIX or HP-UX,download
    Adobe Reader 5.0.11 at
    <http://www.adobe.com/products/acrobat/readstep2.html>
    www.adobe.com/products/acrobat/readstep2.html.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1625>
    CAN-2005-1625

    Disclosure Timeline:
    05.12.05 - Initial vendor notification
    05.12.05 - Initial vendor response
    07.05.05 - Public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by <http://www.idefense.com/> iDEFENSE.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=279>
    http://www.idefense.com/application/poi/display?id=279

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] TCP Chat(TCPX) DoS (Exploit)"
    • Quantcast